We're using Expo Firebase Phone Authentication. We're able to authenticate users using the firebase sdk, so when a new phone number signs up for the first time, we add that phone number to the Users section of the firebase console. However some of these phone numbers need to be marked as admin. Is there any way to do that from the firebase console?
If you are talking about marking particular users as an admin in the Authorization tabs, then no, this is not currently possible.
If you are looking for ways to do role-based authentication, there are many tutorials available on how to do this. But to summarize, there are three main methods for role-based authentication with Firebase.
Device (Client SDK)
Server (Admin SDK)
Console
Relative Difficulty
Realtime Database
read/write¹
read/write
read/write
High
Cloud Firestore
read/write¹
read/write
read/write
Low
Token-based
read-only²
read/write
not visible
Medium
¹: Using these methods, another admin could add/remove admins from the client side if desired.
²: While the client SDK can not edit a user's authentication token, you could use a Cloud Function or your own private server to edit a user's token from the client if they have the appropriate permissions.
Related
I develop an iOS application and I'm using Node & Postgres for handling user data and authentication. I would like to add a chat feature to my app and I chose Firestore for this.
My question is how should I link the existing user data with a Firebase collection of users without re-implementing the authentication part from the ground up. Right now the authentication is based on JWTs with access and refresh tokens.
In order to link my existing users, I can add the userId already present in my database to the users collection that I will create in Firestore, but I need some kind of authentication to ensure security.
While the token for Firebase is also a JWT, it will probably have to be separate from your existing JWT, as it contains Firebase-specific information (such as the project ID), and they're signed with different keys.
After you authenticate the user with your own backend, mint a custom token for Firebase authentication with the information you want to use in Firebase/Firestore and security rules, pass that to the client, and sign them in to Firebase with it.
I am using Firebase Auth to authenticate users using the Email/Password Method. Sometimes I detect spam users that create a lot of accounts from one IP address. I want to block them to protect my app.
I know that there is a method called "Disable User Account" in Firebase Console. I want to use it in my project.
I searched in Stack Overflow as well as the Firebase Docs and found that this only can be done in Admin SDK but I want to use it in the Firebase Web JS SDK. So is there a method to do that like user.DisableAccount?
There is no method to disable a specific user's account in the client-side Firebase SDKs, as that would be a security risk.
But if you look at the documentation for updating a user with the Admin SDK, you'll see there is a property disabled that you can set to true.
From that moment in, that user won't be able to sign in or refresh their ID token. Their existing ID token is still valid though, and by default, that means it may take up to an hour for them to get signed out of your app. If that interval is a concern for your use case, have a look at the documentation on managing user sessions, specifically the section on detecting ID token revocation. While more work, this allows you more granular control of the expiration of the token.
In my app I've 2 login methods(google&facebook) and all the users appear in the Authentication part inside my firebase project, and I haven't list/collection of my users in my database.
I want to display in my app list of users with some personal data.
My question is how do i get access to the users from the Authentication part(to get all the users for example)?
Is it good approach that the users appear only in the Authentication and not inside my database?
You can't list user accounts with the Firebase Authentication client SDK. You can only do that with the Firebase Admin SDK on a backend you control.
If you think it's OK for your users to be able to know all other users, then you should store that information in your database to make it queryable directly from the client, or create some sort of API endpoint where you can invoke the Admin SDK from your app.
I am building a web and mobile app using firebase. When signing with Google, firebase auto creates a new account in the project (Auth) if one does not exist. Its fine with the mobile app.
But with the web, I just want existing users (who created accounts with mobile app) to signin and not create new accounts via web.
How do I setup firebase not to create new accounts if one does not exist?
There isn't a way to restrict social sign-in with Firebase Auth to "only sign in, not sign up".
If you have a means of detecting users that have signed in using the app at some point (e.g. by writing a value to your database in a specific location), you could check for that value when signing in via the web, and, if missing, display a screen encouraging users to install the mobile app.
I think this is what you are looking for:
Link Multiple Auth Providers to an Account Using
JavaScript
You can allow users to sign in to your app using multiple
authentication providers by linking auth provider credentials to an
existing user account. Users are identifiable by the same Firebase
user ID regardless of the authentication provider they used to sign
in. For example, a user who signed in with a password can link a
Google account and sign in with either method in the future. Or, an
anonymous user can link a Facebook account and then, later, sign in
with Facebook to continue using your app.
Is there a firebase call that accepts a number and returns all simplelogins greater than or equal to that number?
For the avoidance of doubt, I'm not referring to data in my app, I'm referring to the list of users maintained separately by Firebase under the Login & Auth tab.
When I refresh users, the ajax call made by the firebase graphical debugger is this:
https://auth.firebase.com/v2/MYAPP/users?forge=true&token=XXX
But I can't get this to work with my secure JSON web token ("firebase secrets")
Firebase keeps the email/password information for users of your application in a separate database.
There is currently no official public API to access your email/password users. You can however see the users in the Login & Auth part of your Firebase's Dashboard.
Most applications that use Firebase Authentication store a copy of their users inside their database, i.e. under a /users node. They can then access it through Firebase's regular APIs.